- Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 10.10.10.50 + Target Hostname: vuln-webapp.ctf.local + Target Port: 8080 + Start Time: 2026-04-07 09:14:22 (GMT-4) --------------------------------------------------------------------------- + Server: Apache/2.4.49 (Ubuntu) + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + /: The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-x-xss-protection-header/ + /: The Content-Security-Policy header is not set. This allows the browser to load resources from any origin, enabling XSS and data injection attacks. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP + /: The Strict-Transport-Security header is not defined. HSTS tells the browser to only communicate over HTTPS. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security + /: The Permissions-Policy header is not set. This allows the browser to enable device features (camera, microphone, geolocation) without restriction. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy + Apache/2.4.49 appears to be outdated (current is at least Apache/2.4.59). Apache 2.4.49 is vulnerable to CVE-2021-41773 (path traversal) and CVE-2021-42013 (RCE via path traversal). See: https://httpd.apache.org/security/vulnerabilities_24.html + /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf + /: Server leaks inodes via ETags, header found with file /., inode: 1a4e2, size: 3b8f, mtime: 662ea1c0. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418 + OPTIONS: Allowed HTTP Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, TRACE . + /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-telecom-icons/ + /icons/README.html: Apache default file found. + /admin/: Admin login page/section found. + /admin/login: Admin login page found. + /admin/dashboard: Admin dashboard accessible without authentication. + /admin/config: Configuration panel found. May contain sensitive settings. + /admin/users: User management interface found. + /admin/logs: Application log viewer found. May contain sensitive information. + /phpmyadmin/: phpMyAdmin installation found. See: https://www.phpmyadmin.net/ + /phpmyadmin/setup/: phpMyAdmin setup page found. This can allow remote attackers to configure phpMyAdmin. + /server-status: Apache mod_status enabled. Reveals active connections, request URLs, and client IPs. See: https://httpd.apache.org/docs/2.4/mod/mod_status.html + /server-info: Apache mod_info enabled. Reveals complete server configuration including loaded modules. + /phpinfo.php: Output of the phpinfo() function was found. This reveals PHP version, server paths, environment variables, and loaded extensions. + /test/: Test directory found. May contain development artifacts and debugging tools. + /test/info.php: Additional PHP info page found in test directory. + /test/debug.php: Debug script found. Outputs internal application state. + /backup/: Directory listing enabled on /backup/. Contains potentially sensitive backup files. + /backup/database.sql.bak: Database backup file found. May contain full database dump with credentials. + /backup/config.php.bak: PHP configuration backup found. Likely contains database credentials. + /backup/site-backup-2026-03-15.tar.gz: Full site backup archive found. + /backup/.htaccess.old: Old Apache configuration file found. + /uploads/: Directory listing enabled on /uploads/. User-uploaded files accessible without authentication. + /logs/: Directory listing enabled on /logs/. Application log files accessible. + /logs/access.log: Web server access log found. Contains request URLs and client IPs. + /logs/error.log: Web server error log found. May contain stack traces and internal paths. + /logs/app-debug.log: Application debug log found. May contain sensitive debugging output. + /.env: Environment configuration file found. Likely contains API keys, database credentials, and secrets. + /.git/HEAD: Git repository metadata found. Source code may be recoverable. See: https://github.com/internetwache/GitTools + /.git/config: Git configuration file accessible. May reveal remote repository URLs. + /wp-login.php: WordPress login page found. Indicates WordPress installation. + /wp-admin/: WordPress admin directory found. + /wp-config.php.bak: WordPress configuration backup found. Contains database credentials and authentication keys. + /xmlrpc.php: WordPress XML-RPC interface found. Can be used for brute-force attacks and DDoS amplification. + /readme.html: WordPress readme file found. Reveals WordPress version. + /license.txt: License file found. May reveal CMS version information. + /robots.txt: Contains 8 entries which should be manually viewed for interesting paths. + /robots.txt: Entry '/secret-admin/' found. Hidden admin panel. + /robots.txt: Entry '/api/internal/' found. Internal API endpoints. + /robots.txt: Entry '/staging/' found. Staging environment. + /sitemap.xml: Sitemap found. Reveals complete site structure including potentially hidden pages. + /crossdomain.xml: Adobe Flash cross-domain policy found. May be overly permissive. + /api/swagger.json: Swagger/OpenAPI specification found. Reveals complete API structure and endpoints. + /api/v1/docs: API documentation page found. Interactive API documentation accessible without authentication. + /cgi-bin/: CGI directory found. May contain vulnerable CGI scripts. + /cgi-bin/test-cgi: Test CGI script found. Reveals server environment variables. + /console: Application debug console found. May allow remote code execution. + /debug/vars: Application debug variables endpoint found. Reveals internal application state. + /actuator: Spring Boot Actuator endpoint found. May expose application health, environment, and configuration. + /actuator/env: Spring Boot environment endpoint. Reveals environment variables and system properties. + /login: Default login page uses HTTP (not HTTPS). Credentials transmitted in plaintext. + /login: No account lockout policy detected. Tested 50 invalid login attempts without lockout. + /register: User registration form does not implement CAPTCHA. Vulnerable to automated account creation. + OSVDB-3092: /doc/: Documentation directory found. + OSVDB-3233: /doc/README: Default documentation file. + OSVDB-3268: /css/: Directory listing enabled on CSS directory. + OSVDB-3268: /js/: Directory listing enabled on JavaScript directory. + OSVDB-3268: /images/: Directory listing enabled on images directory. + /server-status?auto: Apache mod_status auto output found. Machine-readable format. + 8142 requests: 0 error(s) and 68 item(s) reported on remote host + End Time: 2026-04-07 09:19:47 (GMT-4) (325 seconds) --------------------------------------------------------------------------- + 1 host(s) tested